from scapy.all import *
from lib.data import config
from api.ip import ipAnalysis
from api.mongo import findeve, evetomongo
from bson import json_util
import re
import time
import json
import traceback
import random
import traceback


def analyze_suricata_alert(data="ip", language="en", begintime=None, endtime=None):
    eve_lines = findeve("alert", begintime, endtime)
    eve_result = {}
    result = []
    if data == "xy":
        for eve_line in eve_lines:
            eve_info = {}
            eve_line = json_util.dumps(eve_line)
            eve_line = json.loads(eve_line)
            try:
                src = eve_line["src_ip"]
                dest = eve_line["dest_ip"]
                event_type = eve_line["event_type"]
                alert_message = eve_line["alert"]["signature"]
                try:
                    category = eve_line["alert"]["category"]
                except:
                    category = "None"
                action = eve_line["alert"]["action"]
                if event_type == "alert":
                    eve_info["time"] = eve_line["timestamp"]
                    if ipAnalysis.is_internal_ip(src) or re.findall(r'^127\.', src):
                        if ipAnalysis.is_internal_ip(eve_line['client_ip']) or re.findall(r'^127\.', eve_line['client_ip']):
                            try:
                                eve_info["src"] = ipAnalysis.get_city(
                                    config['ip'][0], language, location=True)
                            except:
                                eve_info["src"] = ipAnalysis.get_city(
                                    config['ip'][0], language='en', location=True)
                        else:
                            try:
                                eve_info["src"] = ipAnalysis.get_city(
                                    eve_line['client_ip'], language, location=True)
                            except:
                                eve_info["src"] = ipAnalysis.get_city(
                                    eve_line['client_ip'], language='en', location=True)
                        eve_info["src"]["ip"] = src
                    else:
                        try:
                            eve_info["src"] = ipAnalysis.get_city(
                                src, language, location=True)
                        except:
                            eve_info["src"] = ipAnalysis.get_city(
                                src, language='en', location=True)
                    if ipAnalysis.is_internal_ip(dest) or re.findall(r'^127\.', dest):
                        if ipAnalysis.is_internal_ip(eve_line['client_ip']) or re.findall(r'^127\.', eve_line['client_ip']):
                            try:
                                eve_info["dest"] = ipAnalysis.get_city(
                                    config['ip'][0], language, location=True)
                            except:
                                eve_info["dest"] = ipAnalysis.get_city(
                                    config['ip'][0], language='en', location=True)
                        else:
                            try:
                                eve_info["dest"] = ipAnalysis.get_city(
                                    eve_line['client_ip'], language, location=True)
                            except:
                                eve_info["dest"] = ipAnalysis.get_city(
                                    eve_line['client_ip'], language='en', location=True)
                        eve_info["dest"]["ip"] = dest
                    else:
                        try:
                            eve_info["dest"] = ipAnalysis.get_city(
                                dest, language, location=True)
                        except:
                            eve_info["dest"] = ipAnalysis.get_city(
                                dest, language='en', location=True)
                    try:
                        eve_info["src"]["src_port"] = eve_line["src_port"]
                    except Exception as e:
                        eve_info["src"]["src_port"] = "ICMP or UDP"

                    try:
                        eve_info["dest"]["dest_port"] = eve_line["dest_port"]
                    except Exception as e:
                        eve_info["dest"]["dest_port"] = "ICMP or UDP"
                    eve_info["event_type"] = event_type
                    eve_info["client_ip"] = eve_line['client_ip']
                    eve_info["alert_message"] = alert_message
                    eve_info["category"] = category
                    eve_info["action"] = action
                    eve_info["src"]["src_count"] = random.randint(0, 30)
                    eve_info["dest"]["dest_count"] = random.randint(0, 30)
                    result.append(eve_info)
            except Exception as e:
                print(e)
                pass
    eve_result['data'] = result[::-1]
    eve_result["infonum"] = len(result)
    return eve_result
